Tags › CVE-2026-119292

FreeSWITCH: RTP Bleed, RTP Inject and DoS

We reported two FreeSWITCH media security issues as one finding before ClueCon 2025. They now have separate CVEs: one for RTP Bleed and Inject during call setup, another for one-way media denial on established calls. FreeSWITCH 1.11.2 addresses the latter, but mitigating the former also requires configuration.…

FreeSWITCH: One-way media denial of service through late RTP source validation

• Authors:
  • Enable Security research team
• CVSS v4.0:
  • Base score: 8.7 High
  • Exploitability: High
  • Complexity: Low
  • Attack requirements: None
  • Vulnerable system: High availability impact, no confidentiality or integrity impact
  • Subsequent system: No separate impact scored
  • Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
• CVE: CVE-2026-119292
• Fixed versions: FreeSWITCH 1.11.2 prevents the complete media starvation reproduced on 1.10.12. Later releases containing the same fix are expected to provide the same protection. No configuration change is required for this post-learning path, although very high-rate floods can still cause packet loss.
• Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2026-08-freeswitch-rtp-media-dos/
• Vendor Security Advisory: https://github.com/signalwire/freeswitch/security/advisories/GHSA-w9xc-63w2-7q4x
• Vendor Patch: https://github.com/signalwire/freeswitch/commit/a38cd8073314f7da29b16743b8dbe52fd8505ba7
• Companion advisory: https://www.enablesecurity.com/advisories/ES2026-07-freeswitch-rtp-inject-rtp-bleed/
• Other references:
  • CWE-400: Uncontrolled Resource Consumption
  • FreeSWITCH 1.11.2 release
• Tested vulnerable version: FreeSWITCH 1.10.12
• Tested fixed version: FreeSWITCH 1.11.2
• Affected versions: FreeSWITCH 1.0.0 through 1.11.1, in the default configuration
• Timeline:
  • First discovery and report to FreeSWITCH developers: 2025-06
  • Upstream fix commit: 2026-08-08
  • FreeSWITCH 1.11.2 released: 2026-08-09
  • Enable Security ran the initial fix-validation matrix: 2026-08-11
  • Enable Security corrected and verified the stock-timer and bridged-call impact: 2026-10-28
  • Enable Security submitted the two split GitHub advisories: 2026-10-29
  • Vendor advisory published with CVE listed: 2026-11-03

TL;DR

FreeSWITCH 1.11.1 and earlier processed packets from an unrecognized RTP source before rejecting them. A sustained flood to an active media port could starve incoming audio from that call leg, causing one-way media in a bridged call even when SRTP was in use. FreeSWITCH 1.11.2 rejects these packets earlier without requiring a configuration change; very high-rate floods can still degrade media.